feat(core): DEK 缓存 + 密钥轮换管理端点

- erp-core/crypto/key_manager: DashMap LRU DEK 缓存 (TTL 5min, 100条)
- DekManager: get_or_create_dek, generate_new_dek, invalidate
- PiiCrypto 集成 DekManager
- POST /api/v1/admin/tenants/:id/rotate-key: 生成新 DEK + 缓存失效
- 权限: tenant.manage (仅超级管理员)

crates/erp-core/Cargo.toml

@@ -16,3 +16,10 @@ axum.workspace = true
 sea-orm.workspace = true
 async-trait.workspace = true
 utoipa.workspace = true
+aes-gcm = "0.10"
+hmac = "0.12"
+sha2 = "0.10"
+base64 = "0.22"
+hex = "0.4"
+rand = "0.8"
+dashmap = "6"